For the purposes of this discussion, I have a very current always-on linux machine with two nics:
A very crude diagram of my desired configuration looks like this:
(----------------------------) | linux/main computer | | | ----------- / ~ ~ ~ ~ ~ \ ------- -------| | internet |-- ~ wifi ~ --| wifi0 |------------| eth0 |======) ----------- \ ~ ~ ~ ~ ~ / ------- -------| | | | | (----------------------------) | \ subnet / | \ wifi / | ------------ | | dd-wrt |=================================================) | router |====\ subnet | |====\ subnet ------------
eth0 is connected to a router with a preconfigured firewalled gateway that I trust and is the nic from/to which I should prefer all general traffic flow.
The problem is that the firewalled gateway I trust is no longer a gateway; it has no internet connection.
Rather my internet access comes from wifi0. I wish to wall off wifi0, to forward all its traffic through to my trusted gateway over eth0, and to be able to maintain my own local subnet as managed by my router/gateway primarily on my router/gateway.
So basically I'm looking for a way to configure wifi0 to accept all incoming traffic and forward it immediately through eth0 to my router. I want all outgoing traffic not bound for my local subnet to be sent directly out over wifi0 to the wide-world, but all subnetted traffic to be handled by my local router, and all outgoing traffic - whether from my router or from my internet-connected computer to undergo nat and appear as if it originates from the same address.
It has to be possible, and I'd really like to do it just with
iptables and/or the tools included with current
iproute2 packages. My preference is
networkd for nic init/setup, and I'm aware that I might need to bring up a virtual nic or two in the connected linux box to make it happen, but am fuzzy on details.
Will someone please help me with this? I'm very bad with packet filters and similar.
p.s. I'm hardly married to the title of this question and if someone can think of a more succinct/descriptive one I would be grateful.
If it makes any difference, I can also do:
----- \ router / box \ \ ________ / ---- | / \ eth0 [========] wan port | ---- | | | eth1 [========] lan port [=======\subnet ____ / \ ________ /
...because I do actually have two ethernet nics in my main box besides the wifi0 where the internet is sourced. So I supposed I could forward (or bridge?) all traffic between wifi0 and eth0 and for most intents and purposes ignore those two completely while routing all day-to-day traffic through eth1. I just really don't understand
nftables or any of the rest well enough to effect my goal. Please give me a hand.